CVE-2015-9244 SQL Injection in mysql
CriticalCVSS 9.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with mysql.escape() which could lead to SQL Injection.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm mysql(npm) | <= 2.0.0-alpha7 | No fix listed |
| debian/node-mysql(Debian:12) | < 2.0.0~alpha8-1 | 2.0.0~alpha8-1 |
| debian/node-mysql(Debian:13) | < 2.0.0~alpha8-1 | 2.0.0~alpha8-1 |
| debian/node-mysql(Debian:14) | < 2.0.0~alpha8-1 | 2.0.0~alpha8-1 |
| mysqljs mysql | <= 0.9.6 | No fix listed |
| mysqljs mysql | = 2.0.0-alpha | No fix listed |
| mysqljs mysql | = 2.0.0-alpha2 | No fix listed |
| mysqljs mysql | = 2.0.0-alpha3 | No fix listed |
| mysqljs mysql | = 2.0.0-alpha4 | No fix listed |
| mysqljs mysql | = 2.0.0-alpha7 | No fix listed |
| mysqljs mysql | = 2.0.0-preview | No fix listed |
| HackerOne mysql node module | = <=v2.0.0-alpha7 | No fix listed |
References
- github.com exploit third-party-advisory
- www.npmjs.com
- nvd.nist.gov third-party-advisory
- github.com
- Debian Security Tracker CVE-2015-9244 vendor-advisory
- nodesecurity.io third-party-advisory